7d53472a01ca4ee7b03eed409b3c40ce08d241a5de68f010b092926b401a6008

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 22:41

Target
2026-10-03_fc4528ef8564b51dee2f15b976a03aad_glassworm_icedid_njrat.exe
Size 4.0MB
Sample261003-2mda9aycpe
SHA256 7d53472a01ca4ee7b03eed409b3c40ce08d241a5de68f010b092926b401a6008
MD5 fc4528ef8564b51dee2f15b976a03aad
SHA1 b535fed957ba017d05290b5efaea674c982a30a7
SHA512 0558aa3b9c4e1beeba344c1dacd7d02ff85649d63382cb24a7276e52d6f5a1438c0ada0f26fa92a1572af7a2fb393c5595f2ced7b2b98f5632cf5b0dbe163ce2
SSDEEP 98304:JyzCt5CxU+lIQKQ3k+hEaEQwa4buDneTvi/:hQJassk
TLSH
T1DC167C553F8C80A6DBABD1B7C2758A559272BC160731E2CB35C0B78DEE776509F3AA00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3264	AutoHotkey.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Suspicious use of SendNotifyMessage 3 IoCs

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3264	AutoHotkey.exe
3264	AutoHotkey.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 3264	2952	2026-10-03_fc4528ef8564b51dee2f15b976a03aad_glassworm_icedid_njrat.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-10-03_fc4528ef8564b51dee2f15b976a03aad_glassworm_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-03_fc4528ef8564b51dee2f15b976a03aad_glassworm_icedid_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Users\Admin\AppData\Local\Temp\AutoHotkey.exe
  "C:\Users\Admin\AppData\Local\Temp\AutoHotkey.exe" "\\.\pipe\AHK240769437396483" "C:\Users\Admin\AppData\Local\Temp\2026-10-03_fc4528ef8564b51dee2f15b976a03aad_glassworm_icedid_njrat.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3264

AutoHotkey.exe

Path C:\Users\Admin\AppData\Local\Temp\AutoHotkey.exe
Size 1.1MB
SHA256 f62ff2e9b365893bff3b8338ee65564a5753edfb505ab5b4964b9788d4e0df87
MD5 b7fd8ed4bfbab2e795a83fe5ae3cff4c
SHA1 af2d6bdf539484c8aa65a19868110b3d3e46a179
SHA512 225aa1c0801907fa10f80e2d2e85cf91bfc01bc4bf619ebc4cb1a65db0453decadcdf04ffda0db2d1cb895fd451bc8a32c7ca5cc746b496c2d17818cb6116967
SSDEEP 24576:5djNbBlkFgINP48A15KttuDvfLfmJtNuXQGYN6JH:XjNbBlkFgIG85uDvfeTWQGYI
TLSH
T108458E4773E6C1E8DFB781F6C9315222D6717C1107388BEB25A09A2EDFB3A905A36711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2952-4-0x0000000002B40000-0x0000000002B50000-memory.dmp

Download